CVEvulnerability

CVE-2023-28368

5.7 MEDIUM Published 2023-04-11 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2023-04-11
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
5.7 MEDIUM — CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
5.7 MEDIUM — CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Weaknesses
CWE-1391

Description

TP-Link L2 switch T2600G-28SQ firmware versions prior to 'T2600G-28SQ(UN)_V1_1.0.6 Build 20230227' uses vulnerable SSH host keys. A fake device may be prepared to spoof the affected device with the vulnerable host key.If the administrator may be tricked to login to the fake device, the credential information for the affected device may be obtained.

Affected configurations

• tp-link t2600g-28sq firmware 20190530 • tp-link t2600g-28sq firmware 20200304

Related

Weakness · CWE (1)

  • CWE-1391 Use of Weak Credentials weakness

References